frontend phase 1: auth — phone-OTP login, role routing & session refresh

Replace the username/password stub with Balinyaar's real credential (phone-OTP)
and add the role router every authenticated screen sits behind.

- services/auth rewritten for OTP over the b2 contract: types/keys/constants,
  clientApi+mockApi behind a config'd seam, hooks (useRequestOtp/useVerifyOtp/
  useMe/useRefresh/useLogout/useSelectRole/useSessionRoleSync). Stub removed.
- A1/A2 customer login + B1/B2 nurse switch as one OTP flow at /login
  (PhoneStep/OtpStep: auto-verify, resend countdown, wrong/expired/lockout states).
- Role router: pure resolveRoleDestination + RoleRouter -> family / nurse /
  admin / select-role, with a splash while /me loads (no wrong-shell flash).
- SelectRole first-use screen at /select-role.
- Widened AuthState (roles via SessionUser), hydrated from /me by useSessionRoleSync.
- Fetch-layer silent token refresh (single-flight + one retry) + shared
  persistAuthTokens/clearAuthTokens; useRefresh as the on-demand path.
- auth i18n namespace in both locales; tests for routing branches, countdown,
  OtpStep state machine, RoleRouter branches; fixed jest @/ -> src alias.
- Docs: client/CLAUDE.md, frontend STATUS/report, for-backend REQ-002..004.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

client/messages/en.json

@@ -25,7 +25,9 @@
     "retry": "Retry",
     "add": "Add",
     "cancel": "Cancel",
-    "currency_toman": "Toman"
+    "currency_toman": "Toman",
+    "brand": "Balinyaar",
+    "brand_tagline": "Home care you can trust"
   },
   "shell": {
     "customer_app": "Family app",
@@ -43,5 +45,34 @@
     "gender_male": "Male",
     "gender_female": "Female",
     "added": "Patient added"
+  },
+  "auth": {
+    "customer_title": "Sign in to Balinyaar",
+    "customer_subtitle": "Sign in with your mobile number",
+    "nurse_title": "Nurse sign in",
+    "nurse_subtitle": "For nurses with a Nursing Council licence",
+    "phone_label": "Mobile number",
+    "phone_invalid": "Enter a valid Iranian mobile number",
+    "request_code": "Get verification code",
+    "nurse_switch": "Are you a nurse? Nurse sign in →",
+    "customer_switch": "Are you a family? Family sign in →",
+    "rate_limited": "Too many attempts — please try again shortly",
+    "otp_title": "Enter the verification code",
+    "otp_sent_to": "Code sent to {phone}",
+    "otp_verify_customer": "Verify and continue",
+    "otp_verify_nurse": "Verify and sign in",
+    "otp_invalid": "The code is incorrect or has expired",
+    "otp_locked": "Too many attempts. Request a new code to continue.",
+    "resend_in": "Resend code in {time}",
+    "resend": "Resend code",
+    "change_number": "Change number",
+    "routing_title": "Signing you in…",
+    "select_role_title": "Welcome to Balinyaar",
+    "select_role_subtitle": "Choose how you'll use Balinyaar to get started",
+    "role_customer": "Family",
+    "role_customer_desc": "Book nurses and home care",
+    "role_nurse": "Nurse",
+    "role_nurse_desc": "Offer nursing services",
+    "continue": "Continue"
   }
 }